Configuration Files

Which THREE of the following are true regarding the configuration precedence of apps?

If a user creates a configuration in their 'user' directory, how does it compare in precedence to the 'app' directory?

You need to modify the default behavior of a Splunk application without editing the files inside the 'default' directory. Where should you create the override file?

You need to ensure that specific data is sent to a specific indexer using the outputs.conf file. Which stanza is used for this?

You are troubleshooting a parsing issue. You want to see the configuration file path that contributed a specific setting. What flag should you use with btool?

Which TWO of the following are valid stanza types found in indexes.conf?

Which configuration file is used to define index-time field extractions and line-breaking rules?

Which command is used to restart the Splunk service after modifying configuration files?

What is the effect of setting 'TRANSFORMS-routing' in props.conf?

Where is the global configuration for Splunk Enterprise stored?

If you want to debug why a specific sourcetype is not applying, which btool command helps identify the configuration file responsible?

If a setting is defined in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/my_app/default/props.conf, which one wins?

Which TWO of the following are valid ways to define field extractions?

What is the purpose of the 'TIME_PREFIX' attribute in props.conf?

You have two identical stanzas in different configuration files with the same precedence. How does Splunk determine which one wins?

Which file would you edit to change the TCP listening port for a Splunk Universal Forwarder?

Which TWO of the following are true about 'local' versus 'default' directories?

Which TWO directories are part of the standard Splunk configuration file precedence hierarchy?

Which THREE of the following represent true statements about the 'transforms.conf' file?

Which TWO of the following locations are valid for placing a custom 'inputs.conf' file?

You have defined a setting in $SPLUNK_HOME/etc/system/local/inputs.conf and the same setting exists in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf. Which value takes precedence?

Which file is responsible for defining how data is rotated in an index?

Which THREE of the following are true regarding the behavior of 'btool'?

What is the purpose of the 'disabled=1' attribute in an inputs.conf stanza?

Which stanza is required in props.conf to identify a sourcetype?

How does Splunk handle configuration files that are missing a required attribute?

When using transforms.conf to extract fields, what is the 'SOURCE_KEY' setting used for?

What happens if you have a syntax error in a .conf file?

A user reports that a setting in props.conf is not being applied. You want to see the final merged configuration for a specific sourcetype on a specific host. Which tool should you use?

Which TWO attributes in props.conf are commonly used to handle multiline events?

When using btool, what does the output show by default?

In props.conf, what does the 'REPORT-' prefix signify?

Which THREE configuration files are most critical for defining how data is ingested and parsed?

You need to perform a regex-based routing operation to send data to different indexes based on the host. Which file must be configured to define the routing regex?